Network System and Communication Log Analyzer

ABSTRACT

This invention provides an apparatus that associates a location where a terminal uses communication or travel route in use of the communication, with a connection destination of the terminal. The apparatus includes a communication log analyzer that aggregates communication logs collected by network apparatuses that constitute the mobile network and analyzes it. The communication log analyzer estimates travel route of the terminal connected the network using: log information generated by a base station to be connected to the terminal at the time of starting the connection, log information generated by a base station to be connected to the terminal at the time of a handover of the connection, and log information generated by a base station connected to the terminal at the time of detaching the connection.

CLAIM OF PRIORITY

The present application claims priority from Japanese patent applicationJP2011-081386 filed on Apr. 1, 2011, the content of which is herebyincorporated by reference into this application.

BACKGROUND OF THE INVENTION

The present invention relates to an apparatus that analyzescommunication log information generated by a communication apparatus ina mobile network.

In mobile communication, a communication method referred to as 3rdGeneration is introduced to increase communication speed. Main use ofcommunication is shifted from conventional voice communication to datacommunication. Nowadays, technology development for a communicationmethod referred to as 4th Generation is being promoted to achievetransmission rate of 100 s of Mbit/s to several Gbit/s as fast as wiredcommunication using optical fiber.

On the other hand, terminals in mobile communication have beensophisticated along with increase in communication speed. Inconventional mobile communication, the terminals with voicecommunication function and simple Internet access functions only hadbeen largely used. Nowadays, terminals with sophisticated informationprocessing functions called “smart phone” have been increasing inproportion.

In the sophisticated terminal of smart phone, a wide variety ofapplication programs are available. Compared with the conventionalmobile phone terminal, communication volume flowing in a wireless accessnetwork significantly increases. This necessitates a solution to reducethe load of the wireless access network.

One method for reducing load of the wireless access network employsoffload technology of traffic. The offload technology makes traffic ofmobile terminals to bypass a wireless access network and to go through awired network, so as to reduce load of the wireless access network.Implementation of the offload includes: a method using wireless LAN; amethod in which an extremely-compact base station called femtocell isinstalled at home so as to transfer traffic from the base stations via aoptical access network to Internet; and a method for reducing trafficflowing of contents such as video delivery in the wireless accessnetwork using: cache technology; and locating contents deliverydedicated network referred as Contents Delivery Network (CDN) close tothe terminals.

BRIEF SUMMARY OF THE INVENTION

In business models of the conventional mobile communication,telecommunication carriers operate networks and determine the servicespecification for the network. Based on this specification, the trafficvolume on the network was predicted to design and build the network.

However, smart phones allow users freely to develop applications.Additionally, the users can freely share developed applications betweenthe users to use them. This is shifting the main provider of servicefrom telecommunication carriers to terminal suppliers and serviceproviders. This makes the prediction of traffic volume on the network bytelecommunication carriers more difficult than that in the past.

In order to ensure traffic offload, telecommunication carriers need toknow network usage accurately.

Associating location and travel route of a terminal with a communicationdestination used at the location and the travel route is effective in:locating offload cache and CDN; and designing a network that offloads toa wired network using wireless LAN access.

Obtaining location information of the terminal includes use of GlobalPositioning System (GPS) function on the mobile phone and the smartphone. Using GPS function of the terminal to analyze locationinformation requires that the terminal with the GPS function is alwaysturned on. That is, the terminal is required to: use the GPS function atregular intervals to measure location information at the time; andprovide the location information to a carrier who collects locationinformation (usually, a telecommunication carrier operating the mobilenetwork). This causes increased power consumption of the terminal, thusconsuming a battery faster. Further, obtaining location informationusing the GPS function is not associated with communication usage. Thusthe carrier is always required to collect location information of theterminal regardless of use of the communication of the terminal. Thisposes following problems. The first problem is increased informationvolume collected by a system. The second problem is necessity ofassociation of location information of the terminal in communication useonly with communication use among enormous volume of information whenassociating them. This causes increased throughput for the association.

WO 2009/001400 discloses a method for estimating a travel route and atravel direction of a terminal. Unfortunately, the disclosed inventionaims to achieve low power consumption, while this does not disclose amethod for associating a location and a connection destination of theterminal in order to predict traffic volume.

In order to achieve the above-described object, according to one aspectof the present invention, a network system includes: pluralcommunication units; and a communication log analyzer configured toconnect the plural communication units via a network. The pluralcommunication units generate communication log information, and transmitthe generated communication log information to the communication loganalyzer. The communication log analyzer may be configured to extractcommunication log information of communication between each of at leasttwo communication units and a given terminal, from the communication loginformation received from the plural communication units. The extractedcommunication log information is used to estimate a travel direction ofthe given terminal.

The communication units may include a base station. The terminalwirelessly connects the base station. The communication log analyzer maybe configured to extract at least one of a first communication loginformation and a second communication log information. The firstcommunication log information is generated by the base station when theterminal connects to the base station. The second communication loginformation is generated by the base station when the terminaldisconnects the connection to the base station.

The communication log analyzer may be configured to use the extractedcommunication log information and distance information between therespective base stations so as to estimate a travel distance of theterminal.

The communication log analyzer may be configured to: calculate a traveltime from a generation time in the extracted communication loginformation, the travel time being required for the terminal to travelbetween the base stations; and estimate a travel speed of the terminalfrom the travel distance and the travel time.

The communication log analyzer may be configured to estimate at leastone of a travel route and a travel method from at least one of routeinformation, the travel speed, and the travel direction, the routeinformation including information on routes within each of transmissionranges of the respective base stations.

The communication units may include: a base station connected to theterminal; and a proxy server being connected when the terminal connectsto a WEB server, and the communication log analyzer may be configured toassociate third communication log information generated by the proxyserver, the travel route, and the travel method. The third communicationlog information includes information on the WEB server connected to theterminal.

The present invention ensures estimation of a travel direction and otherinformation of the terminal without using the GPS. This reducesinformation volume for estimating the travel direction and otherinformation of the terminal compared with the use of the GPS.

BRIEF DESCRIPTION OF THE DRAWINGS

A more complete appreciation of the invention and many of the attendantadvantages thereof will be readily obtained as the same becomes betterunderstood by reference to the following detailed description whenconsidered in connection with the accompanying drawings, wherein:

FIG. 1 is a diagram illustrating an exemplary configuration of a networkaccording to an embodiment of the present invention;

FIG. 2 is a block diagram illustrating an exemplary hardwareconfiguration of a communication log analyzer according to theembodiment of the present invention;

FIG. 3 is a block diagram illustrating processes in the communicationlog analyzer according to the embodiment of the present invention;

FIG. 4 is a diagram illustrating an overview of route estimationaccording to the embodiment of the present invention;

FIG. 5 is a sequence diagram illustrating an exemplary communicationsequence for a terminal to connect to a network;

FIG. 6 is a sequence diagram illustrating an exemplary communicationsequence in which the terminal travels, and then a handover to adifferent base station is executed;

FIG. 7 is a sequence diagram illustrating an exemplary communicationsequence in which the terminal is disconnected from the network;

FIG. 8 is a table of an exemplary configuration of a route informationtable stored in a base station information database;

FIG. 9 is a table of an exemplary configuration of a distance tablestored in the base station information database;

FIG. 10 is a table of an exemplary configuration of a terminal tracetable stored in a location information processor;

FIG. 11 is a flowchart illustrating an exemplary calculation procedurein which the communication log analyzer estimates a travel speed of theterminal;

FIG. 12 is a flowchart illustrating an exemplary procedure of routeestimation by the communication log analyzer;

FIG. 13 is a diagram illustrating an exemplary communication loginformation generated by the base station when the terminal is connectedto the base station, executes a handover to the base station, and isdisconnected from the base station;

FIG. 14 is a diagram illustrating an exemplary communication loginformation generated by an AAA server;

FIG. 15 is a diagram illustrating an exemplary communication loginformation generated by a proxy server;

FIG. 16 is a diagram illustrating an exemplary communication loginformation generated by the P-GW;

FIG. 17 is a diagram illustrating an exemplary communication loginformation generated by the S-GW;

FIG. 18 is a diagram illustrating an exemplary communication loginformation generated by the HSS;

FIG. 19 is a table of an exemplary configuration of a table used formapping terminal information;

FIG. 20 is a flowchart illustrating an exemplary procedure to associatea travel route of the terminal and a network connection destination ofthe terminal;

FIG. 21 is a diagram illustrating an exemplary traffic offload viawireless LAN;

FIG. 22 is a diagram illustrating an exemplary traffic offload through acontents delivery network; and

FIG. 23 is a flowchart illustrating an exemplary procedure forgenerating the terminal trace table.

DETAILED DESCRIPTION OF THE INVENTION

Embodiments of the present invention will be described below byreferring to the accompanying drawings.

FIG. 1 is a diagram illustrating an exemplary configuration of a networkaccording to the embodiment of the present invention. In particular,FIG. 1 shows an exemplary network of the Long Term Evolution (LTE).

An exemplary configuration of the network according to the embodiment ofthe present invention includes a communication log analyzer 1, aterminal 31, base stations 21, a Serving Gateway (S-GW) 22, whichcontrols packet transfer, a Packet Data Network Gateway (P-GW) 23, whichis a connection point at Internet side, a mobility management entity 24,which processes as mobility management of terminals and the like, a HomeSubscriber Server (HSS) 25, which controls user subscription informationand the like, a Policy and Charging Rules Function (PCRF) 26, whichdetermine policy of charging rules and the like, an Authentication,Authorization, and Accounting (AAA) Server 27, a proxy server 28, whichrelays between the wireless network 30 and Internet (IP Network) 32, anda Web server 29, which is a connection destination of the terminal.

The present invention may be applied to not only the LTE but also toanother mobile communication method such as Worldwide Interoperabilityfor Microwave Access (WiMAX), a 3rd-Generation mobile communicationmethod of CDMA2000.

FIG. 2 is a block diagram illustrating an exemplary hardwareconfiguration of the communication log analyzer 1 according to theembodiment of the present invention.

The communication log analyzer 1 includes configuration elements such asa network interface 11-1, which collects log information from a networkapparatus, a network interface 11-2, which outputs analysis result tothe external unit, a CPU12, which executes arithmetic processing such asanalyzing, a memory 13, and an auxiliary storage unit 14, which has anaccumulating function of the analysis results and the like.

FIG. 3 is a block diagram illustrating processes in the communicationlog analyzer 1 according to the embodiment of the present invention.

The communication log analyzer 1 includes a processing block 14, whichincludes a log collector 141, a location information processor 143, anda data mapping unit 146.

The log collector 141 collects log information from, for example, thebase station 21 and stores the log information to a log storage 1411 inthe log collector 141. In the communication log collected by the basestation 21, specific examples of information required for analyzingincludes: information for identifying a terminal to communicate, timesat which the terminal connects to a base station and begins thecommunication, times at which the terminal disconnects the connection tothe base station and ends the communication, and information foridentifying the base station, which is used to identify the locationwith which the terminal has had wireless communication. Apparatusesother than the base station 21, for example, the S-GW 22 has loginformation such as a time at which the terminal receives a CreateSession Request signal to begin the communication, and a time at whichthe S-GW 22 sends a Delete Session Response.

The information, which is collected at the base station 21 andextracted, is transmitted to the location information processor 143. Thelocation information processor 143 includes a route estimator 142, aspeed calculator 147, a terminal trace table generator 148, a terminaltrace table 144, and a base station information database 145. The basestation information database 145 includes a route information table 1451and a distance table 1452. The terminal trace table generator 148 in thelocation information processor 143 uses the information collected by thelog collector 141 in order to generate the terminal trace table 144. Thespeed calculator 147 uses information of the terminal trace table 144and the base station information database 145 in order to calculate thetravel speed of the terminal. Additionally, the route estimator 142 usesthe travel speed of the terminal calculated by the speed calculator 147and information in the base station information database 145, in orderto execute processing for estimating the travel route of the terminal.

The route estimation result analyzed by the location informationprocessor 143 and extracted information from log information, which iscollected from apparatuses such as the S-GW 22 and the P-GW 23, aretransmitted to the data mapping unit 146. The data mapping unit 146verifies the terminal and the times in order to associate the loginformation generated by respective units with communication informationof the same terminal at the same time. Thus the data mapping unit 146generates ID mapping, which is indicated as 1460, of the terminal.

FIG. 8 is a table of an exemplary configuration of the route informationtable 1451 stored in the base station information database 145 in thelocation information processor 143.

The route information table 1451 includes entries to associate the basestations 21 with line information within respective cells (within thetransmission ranges of the respective base stations) which the basestations 21 each cover.

FIG. 9 is a table of an exemplary configuration of the distance table1452 stored in the base station information database 145 in the locationinformation processor 143.

The distance table 1452 includes distances between every two basestations 21 to be set.

FIG. 10 is a table of an exemplary configuration of the terminal tracetable 144 stored in the location information processor 143.

The terminal trace table 144 is divided by the every terminal. Theterminal trace table 144 includes times, when communication logs aregenerated, and table entries, which are configured with combinations ofbase stations that generate the communication log.

FIG. 4 is a diagram illustrating an overview of route estimationaccording to the embodiment of the present invention.

In FIG. 4, at first, the terminal 31 wirelessly connects to a basestation 21-1 that covers a cell 30-1. The base station 21-1 thengenerates a communication log regarding the terminal 31. The terminal 31travels while communicating so as to enter in a cell 30-2 covered by abase station 21-2. The terminal 31 executes a handover between the basestations 21-1 and 21-2 during travelling between the cells. At thistime, the base station 21-2 generates a communication log regarding theterminal 31. Next, the terminal 31 executes a handover during travellingto the cell 30-3. The base station 21-3 generates a communication logregarding the terminal 31. The terminal 31 in the cell 30-3 ends thecommunication. At this time, the base station 21-3 generates acommunication log.

The communication log analyzer 1 uses these communication logs inaccordance with the procedure shown in FIG. 11, so as to estimate thetravel route and the travel speed of the terminal 31.

The communication log analyzer 1 further verifies the estimated travelroute and the travel speed with map information in accordance with theprocedure shown in FIG. 12. This ensures estimation of thetransportation method of the terminal.

The estimated travel speed, travel route, and transportation methodallow to predict the destination after a certain period of time. In anexample shown in FIG. 4, use of the route information table shown inFIG. 8 indicates the destination of terminal 31 in the future within anarea of the cell 30-4 covered by the base station 21-4.

In FIG. 4, each of the base stations 21 covers each area shown as one ofthe cells 30 for simplification. However, the practical mobilecommunication system divides the each cell 30 into plural areas referredto as sectors. Thus one base station may cover plural areas.

Referring to FIG. 5 to FIG. 7, timings at which the base stationsgenerates communication log will be described. In FIG. 5 to FIG. 7, asexemplary sequences of processing of the LTE between apparatuses such asthe base stations for network connection, a handover, and networkdisconnection.

FIG. 5 is a sequence diagram illustrating a communication sequence forthe terminal to connect to the network.

The terminal sends an Attach Request signal SQ100, to which own terminalinformation is set, to the base station 21. At this time, the basestation 21 generate a communication log for the terminal 31 as shown inFIG. 13. The communication log includes: the terminal ID as informationto identify the terminal 31; information to identify the cell asinformation to identify the base station; information to identify thesector; and times at which the terminal is connected to the basestation, executes a handover, and is disconnected from the connection.The Attach Request signal SQ100 is sent to the MME 24 via the basestation 21.

In SQ110, the MME 24 executes theAuthentication-information-request/answer between the HSS 25 and the MME24 to authenticate the terminal. In this process, the MME 24 and the HSS25 generate communication logs regarding the terminal 31. Thecommunication logs includes information to identify the terminal 31 andthe information on the times as shown in FIG. 18.

In SQ120, the terminal 31 executes processing for TerminalAuthentication between the MME 24 and the terminal 31.

In SQ130, processing for Location Registration of the terminal isexecuted between the MME 24 and the HSS 25.

The MME 24 sends a Create Session Request signal SQ140 to the S-GW 22.In SQ150, the S-GW 22 obtains information to create a route between theS-GW 22 and the P-GW 23 from the PCRF 26. The S-GW 22 sends a CreateRoute Request signal SQ160 to the P-GW 23. In SQ170, the P-GW 23executes processing for User Authentication between the AAA 27 and theP-GW 23. At this time, the AAA 27 notifies an IP address to be assignedto the terminal 31 to the P-GW 23, while the AAA 27 generates acommunication log regarding the terminal 31 as shown in FIG. 14. Thecommunication log includes information to identify the terminal 31 suchas a session ID and a user ID, the IP address assigned to the terminal,and an authentication time.

The P-GW 23 sends a Create Route Response signal SQ180 to the S-GW 22.

The MME 24 sends a Bearer Setup Request signal SQ200 between the MME 24and the base station 21 to the base station 21. The MME 24 further sendsan Attach Complete message SQ210 to the terminal 31. The attach completesignal SQ210 includes information such as the IP address to be assignedto terminal 31 issued by the AAA 27.

The base station 21 sends an Initial Setup Response SQ220 to the MME 24in response to the Bearer Setup Request signal SQ200.

The terminal 31 sends an Attach Complete Response SQ230 to the MME 24 inresponse to the Attach Complete signal SQ210.

FIG. 6 is a sequence diagram illustrating a communication sequence inwhich a terminal travels, and then a handover to a different basestation is executed.

The terminal 31 executes a Measurement Control And Response (SQ300)between the base station 21-1 and the terminal 31 in the connection. Inthe case where the terminal 31 travels and then the base station 21-2with better quality of wireless access is found, the base station 21-1sends a Handover Request (SQ310) to the base station 21-2. The basestation 21-2 sends a Handover Request Acknowledge (SQ320). The basestation 21-1 sends a Handover Command (SQ330) to the terminal 31. Theterminal 31 sends a Handover Confirmation Message (SQ340) to the nextbase station 21-2. At this time, the base station 21-2 generates loginformation regarding the terminal 31 as shown in FIG. 13.

FIG. 7 is a sequence diagram illustrating a communication sequence inwhich the terminal is disconnected from the network.

The terminal 31 sends a Detach Request Signal SQ400 to the MME 24 viathe base station 21.

The MME 24 sends a Delete Session Request signal SQ410 to the S-GW 22.

The S-GW 22 executes processing for Session Release (SQ420) between thePCRF 26 and the S-GW 22. The S-GW 22 in SQ430 then deletes a sessionbetween the P-GW 23 and the S-GW 22. In this process, the S-GW 22 andthe P-GW 23 generates respective log information regarding the terminal31.

The S-GW 22 sends a Delete Session Response signal SQ470 to the MME 24in response to the Delete Session Request signal SQ410.

The MME 24 sends a Release Command signal SQ480 between the MME 24 andthe base station 21 to the base station 21. The base station 21 sends aConnection Release signal SQ490 to the terminal 31. At this time, thebase station 21 generates log information regarding the terminal 31shown in FIG. 13.

The base station 21 sends a Release Complete signal SQ500 to the MME 24in response to the Release Command signal SQ480.

FIG. 11 is a flowchart illustrating an exemplary calculation procedurein which the communication log analyzer estimates a travel speed of theterminal.

The terminal trace table regarding the terminal for which the travelspeed is estimated is referred (FL110). In the terminal trace table,extracting two entries temporally next to one another extracts twoconnected base stations during the traveling of the terminal (FL120). Adistance between the two extracted base stations is obtained using thedistance table (FL130).

The distance between cells are divided by the temporal difference atwhich the two entries are generated. This value is an estimated value ofthe travel speed of the terminal (FL140).

FIG. 12 is a flowchart illustrating an exemplary procedure of routeestimation by the communication log analyzer.

The terminal trace table is referred to extract a cell through which theterminal has travelled. The route information table is referred so as torefer to an entry regarding the cell. Thus line information within anarea of the cell is searched (FL210).

Similarly to the FL210, the line information is searched within the areaof the cell for the cell through which the terminal has travelled(FL220).

The line common to the first cell and the second cell is confirmed(FL230).

In the case where the line in common is not confirmed, the line isdetermined as absent (FL290). Then the processing is ended (FL300).

In the case where the lines in common are confirmed, the lines in commonare determined if it is plural or singular (FL240).

In the case where plural lines are confirmed, it is determined whetheruse of the estimated travel speed of the terminal allows to identify theline or not (FL250).

If the estimated travel speed of the terminal is available to identifythe line, the terminal is determined to be travelling on the line. Thenthe processing is ended (FL260).

If the estimated travel speed of terminal does not allow to identify theline, the entry regarding the next base station is searched in the routeinformation table (FL270).

In FL240, in the case where it is determined that the single line isconfirmed, the terminal is determined to be travelling on the line(FL280). Then the processing is ended (FL300).

FIG. 13 is a diagram illustrating an exemplary communication loginformation 2100 generated by the base station when the terminal isconnected to the base station, executes a handover to the base station,and is disconnected from the base station. The log information generatedby the base station includes: information to identify the base station;a terminal ID assigned to its terminal hardware; information to identifya cell to which the terminal has connected, executed a handover, andbeen disconnected from the connection; information to identify a sectorto which the terminal has connected, executed a handover, and beendisconnected from the connection; a time at which the terminal connectedto the base station; a time at which the terminal executes a handover tothe base station; and a time at which the terminal is disconnected fromthe connection to the base station. Here the base station generatescommunication log information of terminal ID includes, for example, ahardware ID which is uniquely assigned to each terminal. The basestation generates communication log information 2100 based on thetimings as described above using FIG. 5 to FIG. 7.

The generating procedure of the terminal trace table 144 shown in FIG.10 will be described. The communication log analyzer 1 shown in FIG. 3includes the terminal trace table generator 148 in the processing block14. The terminal trace table generator 148 extracts the communicationlog 2100 shown in FIG. 13, which is generated by the base station 21,from the log storage 1411. The terminal trace table generator 148 alsoextracts the terminal ID information, which is included in thecommunication log 2100 (FL510). One of times at which the communicationlog 2100 generates, namely, the connection time set to communication log2100, the handover time, and the detach time, is extracted. Theextracted time is set to the terminal trace table 144 (FL520). Further,the cell information and the sector information shown in FIG. 13 are setto the terminal trace table 144 (FL530).

FIG. 14 is a diagram illustrating an exemplary communication loginformation 2700 generated by an AAA server. The communication loginformation 2700 generated by the AAA server includes information toidentify the AAA server that generates the log, the session ID, the userID, the IP address assigned to the terminal, and a time at which theuser is authenticated.

FIG. 16 is a diagram illustrating an exemplary communication loginformation 2300 generated by the P-GW. The log information generated bythe P-GW includes information to identify the P-GW that generates thelog, information of a GRE key to identify the tunnel established betweenthe S-GW and the P-GW, a session ID to identify the session, and thegeneration time of the log.

FIG. 17 is a diagram illustrating an exemplary communication loginformation 2200 generated by the S-GW. The communication loginformation 2200 generated by the S-GW includes information to identifythe S-GW, the terminal ID, information of a GRE key to identify thetunnel established between the S-GW and the P-GW, and the generationtime of the log.

FIG. 18 is a diagram illustrating an exemplary communication loginformation 2500 generated by the HSS. The log information 2500generated by the HSS includes information to identify the HSS, theterminal ID, and the generation time of the log.

FIG. 19 is a table of an exemplary configuration of the table formapping terminal information 1460. The table for mapping terminalinformation 1460, in the network connection procedure of the terminal 31described in FIG. 5, executes ID mapping of each unit that transmits andreceives messages. In FIG. 19, the terminal ID shown in FIG. 13 in thelog information 2100 generated by the base station 21, the terminal IDand the GRE key shown in FIG. 17 in the log information 2200 generatedby the S-GW 22, the GRE key and the terminal IP address shown in FIG. 16in the log information 2300 generated by the P-GW 23, are used toexecute mapping. The exemplary mapping includes mapping of the terminalID as a hardware ID assigned to the terminal and the IP address assignedby the AAA 27. This mapped information allows to associate loginformation respectively generated by the base station 21, the S-GW 22,and the P-GW 23 with each other regarding the same terminal.

FIG. 15 is a diagram illustrating an exemplary communication loginformation 2800 generated by a proxy server. The communication loginformation 2800 is generated by the proxy server when the terminal 31is connected to the Web server 29, the HTTP session between the terminal31 and the Web server 29 is accepted, and the HTTP session is ended. Theproxy server generates the communication log information, which includesinformation to identify the proxy server that generates the log, theterminal ID, the destination information, the accepted time of the HTTPsession, and the ended time. Here information set to the terminal ID is,for example, the IP address of the transmission source that is set tothe packets, which are transmitted to the Web server by the terminal.The destination is, for example, Uniform Resource Locator (URL).

FIG. 20 is a flowchart illustrating an exemplary procedure to associatea travel route of the terminal and a network connection destination ofthe terminal through a network.

The communication log analyzer 1 includes the data mapping unit 146 inthe processing block 14. The data mapping unit 146 uses the table formapping terminal information 1460 shown in FIG. 19 in order to selectthe hardware ID of the terminal, which is an object to associate(FL410). The data mapping unit 146 searches the IP address assigned tothe terminal corresponding to the hardware ID using the associated loginformation shown in FIG. 13 to FIG. 18 (FL420). Specifically, the tablefor mapping terminal information 1460 shown in FIG. 19 includes: thehardware ID as the terminal ID of the communication log 2100 generatedby the base station 21 shown in FIG. 13; the GRE key as the terminal IDof the communication log 2200 generated by the S-GW 22 shown in FIG. 17;and the assigned IP address as the terminal ID of the communication log2300 generated by the P-GW 23 shown in FIG. 16.

The data mapping unit 146 uses the terminal trace table 144 shown inFIG. 10 in order to select a time zone when the terminal connects to thebase station 21 (FL430).

The data mapping unit 146 uses the proxy log information 2800 shown inFIG. 15 as follows. In the step FL420, the IP address associated withthe hardware ID of the terminal is used to extract the log informationincluding the HTTP session accepted time and the HTTP session ended timethat are matched with the time zone when the terminal was connected.This extracts the destination information in the time zone (FL440).

As described above, the procedure according to the embodiment associatesthe connection location or the travel route of the terminal with thenetwork connection destination of the terminal.

As an effect of associating the connection location or the travel routeof the terminal with the network connection destination of the terminal,an example of implemented traffic offload will be described.

FIG. 21 is a diagram illustrating an example of traffic offload viawireless LAN.

In an example in FIG. 21, an ordinary connection path from the terminal31 to the Web server 29 is shown as RT100. Here, in a method accordingto the embodiment of the present invention, when it is determined thatthe number of connection of the base station 21 to the Web server 29 orthe traffic volume is large, a path RT200 is set as a path to bypass thetraffic. In the path RT200, the terminal 31 connects to the access point40 of wireless LAN and then connects to the Web server 29 through theInternet 32 via the wired network 44.

FIG. 22 is a diagram illustrating an example of traffic offload througha contents delivery network.

The ordinary connection path between the terminal 31 and the videodelivery server 51-1 is shown as the RT100. Here, in method according tothe embodiment of the present invention, when it is determined that thenumber of connection of the base station 21 to the video delivery server51-1 or the traffic volume is large, a path RT300 that includes thecontents delivery network 50 is set so as to reduce the traffic of theordinary connection path including the P-GW 23 and the IP Network 32.

The embodiment according to the present invention allows to associatethe travel route and the connection destination of the terminal. Thisensures collection of necessary information for network design in orderto perform the traffic offload to reduce load of the wireless accessnetwork.

Further, this allows to recommend an appropriate connection destinationcorresponding to the travel destination of the users of thecommunication. Specifically, in the case where wireless LAN connectionservice on train is provided, this enables the communication loganalyzer to provide the analysis result as follows. For users who haverepeatedly used the line in the past and connected to the network, thewireless LAN connection service on train is recommended to use insteadof the network via wireless access network.

Related attribution (such as age and gender) of the users of thecommunication, the location of the communication by the users, and thetravel route may be associated to obtain information that is availableto provide service corresponding to the location.

The present invention can be embodied and practiced in other differentforms without departing from the spirit and essential characteristics ofthe present invention. Therefore, the above-described embodiments areconsidered in all respects as illustrative and not restrictive. Thescope of the invention is indicated by the appended claims rather thanby the foregoing description. All variations and modifications fallingwithin the equivalency range of the appended claims are intended to beembraced therein.

1. A network system comprising: a plurality of communication units; anda communication log analyzer configured to connect the plurality ofcommunication units via a network, wherein the plurality ofcommunication units generate communication log information, and transmitthe generated communication log information to the communication loganalyzer, the communication log analyzer is configured to extractcommunication log information of communication between each of at leasttwo communication units and a given terminal, from the communication loginformation received from the plurality of communication units, and theextracted communication log information are used to estimate a traveldirection of the given terminal.
 2. The network system according toclaim 1, wherein the communication units includes a base station, theterminal wirelessly connecting the base station, and the communicationlog analyzer is configured to extract at least one of a firstcommunication log information and a second communication loginformation, the first communication log information being generated bythe base station when the terminal connects to the base station, thesecond communication log information being generated by the base stationwhen the terminal disconnects the connection to the base station.
 3. Thenetwork system according to claim 2, wherein the communication loganalyzer is configured to use the extracted communication loginformation and distance information between the respective basestations so as to estimate a travel distance of the terminal.
 4. Thenetwork system according to claim 3, wherein the communication loganalyzer is configured to: calculate a travel time from a generationtime in the extracted communication log information, the travel timebeing required for the terminal to travel between the base stations; andestimate a travel speed of the terminal from the travel distance and thetravel time.
 5. The network system according to claim 4, wherein thecommunication log analyzer is configured to estimate at least one of atravel route and a travel method from at least one of route information,the travel speed, and the travel direction, the route informationincluding information on routes within each of transmission ranges ofthe respective base stations.
 6. The network system according to claim5, wherein the communication units includes: a base station connected tothe terminal; and a proxy server being connected when the terminalconnects to a WEB server, and the communication log analyzer isconfigured to associate third communication log information generated bythe proxy server, the travel route, and the travel method, the thirdcommunication log information including information on the WEB serverconnected to the terminal.
 7. A communication log analyzer for analyzingcommunication log information of a communication unit constituting anetwork, the communication log analyzer comprising: a communication logcollector configured to collect communication log information receivedfrom the communication unit; a communication log extractor configured toextract communication log information of communication between each ofat least two communication units and a given terminal from the collectedcommunication log information; a location information processorconfigured to estimate a travel direction of the given terminal from theextracted communication log information.
 8. The communication loganalyzer according to claim 7, wherein the communication units includesa base station, the terminal wirelessly connecting the base station, andthe communication log extractor is configured to extract at least one ofa first communication log information and a second communication loginformation, the first communication log information being generated bythe base station when the terminal connects to the base station, thesecond communication log information being generated by the base stationwhen the terminal disconnects the connection to the base station.
 9. Thecommunication log analyzer according to claim 8, further comprising astorage configured to store distance information between the respectivebase stations, wherein the location information processor uses theextracted communication log information and the distance information soas to estimate a travel distance of the terminal.
 10. The communicationlog analyzer according to claim 9, wherein the location informationprocessor is configured to: calculate a travel time from a generationtime in the extracted communication log information, the travel timebeing required for the terminal to travel between the base stations; andestimate a travel speed of the terminal from the travel distance and thetravel time.
 11. The communication log analyzer according to claim 10,wherein the storage is configured to include route information includinginformation on routes within each of transmission ranges of therespective base stations, and the location information processor isconfigured to estimate at least one of a travel route and a travelmethod from at least one of the route information, the travel speed, andthe travel direction.
 12. The communication log analyzer according toclaim 11, wherein the communication units includes: a base stationconnected to the terminal; and a proxy server being connected when theterminal connects to a WEB server, the communication log extractor isconfigured to extract third communication log information includinginformation on the WEB server connected to the terminal, and thelocation information processor is configured to associate the thirdcommunication log information generated by the proxy server, the travelroute, and the travel method.